Comment by maxo133

2 days ago

AI-generated "research" once more. How can anyone call it full writeup?

As someone pointed out in the X argument comments, this is unconfirmed and most likely NOT how the actual GDID being sent to microsofts servers looks like.

1. The GDID that most closely resembles the one mentioned in the DOJ indictment of Stokes is found inside the registry key Computer\HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\IrisService\IrisActionCreatives, which starts with the "g:" prefix and is explicitly called GLOBALDEVICEID. This keys holds cached json response from microsoft servers and this is clear as night and day what value microsoft servers consider a "GDID"

2. According to the research, a Microsoft account is required. No, it's not necessary. Whether or whether you are not logged into your Microsoft device, GDID is being filled in. Did AI forget to check that?

3. How can author claim this is full writeup of GDID, when you did not verify whether the value your AI found, is the one being sent along with telemetry network requests? Author did not even verify whether he found the right thing

I also verified the value computed as suggested by the repository's creator and it is different from the value discovered inside the Iris registry key that begins with "g:".

Summary: The value author of repo claims is a GDID, is not the same value as saved on microsoft servers.

Very interesting.

Some users have been deleting the entire IrisService in the registry, it appears to also be related to the systray icons on the taskbar.

The first link is a couple years old but the second one is from a couple months ago. Apparently triggered now by the latest update kb5094126, so there may be some questionable new changes going on in this particular monkey-business department:

https://gist.github.com/JMMBA/d56923502a74b6b7196dd800fad0a8...

https://thegeekpage.com/taskbar-missing-after-sign-in-6-fixe...

"Fix 3" is the one where the IrisService reg key is nuked.